fix(ag-ui-proxy): move out of /api/ namespace so route doesn't shadow into langgraph proxy

[blove]

Problem

Production smoke against examples.threadplane.ai showed POST /ag-ui/streaming/agent with an evil Origin returning {"detail":"Not Found"} (FastAPI body) with x-api-key in access-control-allow-headers — meaning the request hit the langgraph proxy at LangGraph Cloud, not the ag-ui-proxy.

Root cause: route table in scripts/assemble-examples.ts:

{ src: '^/ag-ui/([^/]+)/agent(/.*)?$', dest: '/api/ag-ui-proxy/$1$2', check: true },
{ src: '^/api/(.*)',                   dest: '/api/[[...path]]',    check: true },

With check: true, after the first rewrite Vercel re-evaluates routes. /api/ag-ui-proxy/streaming matches rule 2, which rewrites again to the langgraph catch-all function — shadowing our function.

Fix

Move the ag-ui proxy out of /api/:

• Function path: functions/ag-ui-proxy/[[...path]].func (was functions/api/ag-ui-proxy/...)
• Route dest: /ag-ui-proxy/$1$2 (was /api/ag-ui-proxy/$1$2)
• parseProxyPath in ag-ui-proxy.ts updated to expect ['ag-ui-proxy', '<topic>', ...] instead of ['api', 'ag-ui-proxy', '<topic>', ...]

After the rewrite, the path /ag-ui-proxy/<topic> no longer matches the langgraph rule, falls through to the filesystem handle, finds the function, served.

Test plan

• CI green
• Post-merge: examples.threadplane.ai/ag-ui/streaming/agent with wrong Origin returns 403 {"error":"origin_not_allowed"}
• Post-merge: same path with allowed Origin returns streaming AG-UI events

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
threadplane	Ready	Preview, Comment	Jun 6, 2026 2:18pm